BackedBy security record
As of 3 Nov 2026, BackedBy has 1 audit report on Trustblock, by CertiK, dated 4 Jan 2023. That report lists no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Audits1
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| BackedBy - Audit | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
Findings6
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 1 | 1 |
| Medium | 0 | 0 | 0 |
| Low | 0 | 0 | 4 |
HighIncorrect handling of _ownedProfiles mapping updaBackedBy - Audit · CertiK · 4 Jan 2023Fixed
There is an issue with the current logic for updating the `_ownedProfiles` mapping within the `editProfile()` code for the original owner when ownership transfers occur. The current logic sets the final index of the `_ownedProfiles` mapping of the original owner to the `profileId` of the profile that is being set to change owners: ```solidity=97 _ownedProfiles[msg.sender][_ownersTotalProfiles[msg.sender] - 1] = _ownedProfiles[msg.sender][_ownedProfilesIndexes[msg.sender][profileId]]; ``` This line of code overwrites the last profile index of the caller's `_ownedProfiles` mapping to the profile that is being transferred to the new owner. This means that the profile that is supposed to be transferred remains in the caller's mapping and even overwrites the caller's last active profile. This would also have an impact when `getOwnersProfiles()` is run since the `profileId` that is being transferred is still being shown under the previous owner in the `_ownedProfiles` mapping.
Open the reportLowChange logic to skip irrelevant `renewIndexes`BackedBy - Audit · CertiK · 4 Jan 2023Fixed
The current logic for `performUpKeep()` might result in the function reverting after a series of updates and payments, which will be a waste of gas, and updates will need to be executed again from the beginning. The issue is mainly related to the two require statements as shown below: ```solidity=95 require(_subscriptions[renewIndexes[i]].expiration < block.timestamp, BBErrorCodesV01.SUBSCRIPTION_NOT_EXPIRED); require(_subscriptions[renewIndexes[i]].cancelled == false, BBErrorCodesV01.SUBSCRIPTION_CANCELLED); ```
Open the reportLowLack of checks for types of token contracts accepBackedBy - Audit · CertiK · 4 Jan 2023Fixed
The design currently allows anyone to run the `deploySubscriptions()` function and set a subscription to allow any valid currency contract address. This might allow attackers to use malicious contracts included as a `currency` contract.
Open the reportLowLacks checks of input parameters decoded from inpBackedBy - Audit · CertiK · 4 Jan 2023Fixed
For both functions `checkUpkeep()` and `performUpkeep()` there is no checking of the parameters decoded from the input data. Specifically for sensitive information like the `renewIndexes` and `refundReceiver` addresses, it would be useful to have a check to ensure that valid input values have been submitted into the function.
Open the reportLowLogic can be consolidated for `checkUpkeep()`BackedBy - Audit · CertiK · 4 Jan 2023Fixed
The two loops within function `checkUpKeep()` are essentially looping through the same values twice.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="backedby"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us